Report suspected vulnerabilities, active exploitation, or security incidents affecting Json.NET Schema privately to contact@newtonsoft.com.

Include, where possible:

• The affected package version.
• A description of the issue and its potential impact.
• Reproduction steps or a proof of concept.
• Whether exploitation has been observed or is suspected.
• Any known mitigations.

Do not disclose the issue publicly until a fix or mitigation is available and coordinated disclosure has been agreed. Do not include secrets, personal data, or other sensitive information that is not necessary to investigate the report.

Newtonsoft will promptly assess reports, coordinate remediation and disclosure, and inform affected users when appropriate. When a report concerns an actively exploited vulnerability or a severe incident affecting the security of Json.NET Schema, the maintainers will use the reporting process required by Article 14 of the EU Cyber Resilience Act, including:

• An early warning through the ENISA Single Reporting Platform within 24 hours of becoming aware.
• A full notification within 72 hours of becoming aware.
• A final report within the applicable statutory deadline.

Security fixes and advisories will be published through the project's normal release and GitHub advisory channels.